org.apache.pdfbox vulnerabilities

Products

• org.apache.pdfbox/pdfbox 8
• org.apache.pdfbox/pdfbox-examples 2
• org.apache.pdfbox/pdfbox-parent 2

Latest org.apache.pdfbox CVEs

Newest publication first

1. CVE-2026-33929 Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code

   Published 2026-04-14

   Medium·CVSS 4.3 EPSS 0.72%

   Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples. This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7. Users are recommended to update to v...

2. CVE-2026-23907 Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code

   Published 2026-03-10

   Medium·CVSS 5.3 EPSS 0.99%

   This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6. The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getF...

3. CVE-2021-31812 A carefully crafted PDF file can trigger an infinite loop while loading the file

   Published 2021-06-12

   Medium·CVSS 5.5 EPSS 3.1%

   In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.

4. CVE-2021-31811 A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading a tiny file

   Published 2021-06-12

   Medium·CVSS 5.5 EPSS 3.6%

   In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.

5. CVE-2021-27906 A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file

   Published 2021-03-19

   Medium·CVSS 5.5 EPSS 3.3%

   A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.

6. CVE-2021-27807 A carefully crafted PDF file can trigger an infinite loop while loading the file

   Published 2021-03-19

   Medium·CVSS 5.5 EPSS 3.0%

   A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.

7. CVE-2019-0228 Vulnerability that affects org.apache.pdfbox:pdfbox

   Published 2019-04-17

   Critical·CVSS 9.8 EPSS 9.5%

   Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.

8. CVE-2018-11797 In Apache PDFBox a carefully crafted PDF file can trigger an extremely long running computation

   Published 2018-10-05

   Medium·CVSS 5.5 EPSS 3.5%

   In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.

9. CVE-2018-8036 Loop with Unreachable Exit Condition in Apache PDFBox

   Published 2018-07-03

   Medium·CVSS 6.5 EPSS 3.9%

   In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.

10. CVE-2016-2175 High severity vulnerability that affects org.apache.pdfbox:pdfbox

    Published 2016-06-01

    High·CVSS 7.8 EPSS 3.8% Public exploit

    Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.